[FlightReply] Performance improvements when decoding by eps1lon · Pull Request #37087 · react/react

eps1lon · 2026-07-21T15:19:19Z

This fixes security vulnerabilities in Server Functions.

This PR contains the following updates: | Package | Type | Update | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | pinDigest | → `3d3c42e` | | | | [actions/setup-node](https://github.com/actions/setup-node) | action | pinDigest | → `8207627` | | | | [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | action | pinDigest | → `e6de054` | | | | [pnpm/action-setup](https://github.com/pnpm/action-setup) | action | pinDigest | → `0ebf471` | | | | [react](https://react.dev/) ([source](https://github.com/react/react/tree/HEAD/packages/react)) | dependencies | patch | [`19.2.7` → `19.2.8`](https://renovatebot.com/diffs/npm/react/19.2.7/19.2.8) | ![age](https://developer.mend.io/api/mc/badges/age/npm/react/19.2.8?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/react/19.2.7/19.2.8?slim=true) | | [react-dom](https://react.dev/) ([source](https://github.com/react/react/tree/HEAD/packages/react-dom)) | dependencies | patch | [`19.2.7` → `19.2.8`](https://renovatebot.com/diffs/npm/react-dom/19.2.7/19.2.8) | ![age](https://developer.mend.io/api/mc/badges/age/npm/react-dom/19.2.8?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/react-dom/19.2.7/19.2.8?slim=true) | --- ### Release Notes <details> <summary>react/react (react)</summary> ### [`v19.2.8`](https://github.com/react/react/releases/tag/v19.2.8): 19.2.8 (July 21st, 2026) [Compare Source](react/react@v19.2.7...v19.2.8) #### React Server Components - Performance improvements when decoding ([#37087](react/react#37087) by [@eps1lon](https://github.com/eps1lon)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.com/gitea/docs/pulls/475 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com>

Updates `react` and `react-dom` together to **19.2.8**, and stops Dependabot from splitting the pair again. ## Why this update React 19.2.8 (2026-07-21) was released simultaneously with 19.1.9 and 19.0.8 — the backport pattern that signals a security patch. It is: [#37087](react/react#37087), `[FlightReply] Performance improvements when decoding`, whose author notes it "fixes security vulnerabilities in Server Functions." **That fix does not reach RaioPDF's runtime.** `apps/ui` is a client-only Vite SPA rendered with `createRoot` inside the Tauri WebView. There are no Server Components, no Server Functions, and no `react-server-dom-*` packages anywhere in the lockfile; `react-dom/server` appears only in vitest files. So this is dependency hygiene at the current patch floor, not an urgent fix — but it is free, and it puts the app on the version that carries the patch. ## Why both packages in one commit `react-dom@19.2.8` declares `react: ^19.2.8` as a peer, and React itself throws `Incompatible React versions` at runtime if the two differ. Dependabot's #314 and #318 each moved one half, leaving the pair mismatched — that is why they were red. This commit moves both. The `apps/ui` specifiers also tighten from `^19.0.0` to `^19.2.8` so the manifest records the lockstep floor, matching how the rest of the app's dependencies are pinned (`pdfjs-dist: ^6.2.108`, `@tauri-apps/api: ^2.11.1`). ## Root-cause fix `.github/dependabot.yml` now groups `react`, `react-dom`, `@types/react`, and `@types/react-dom`. Without it, the next React patch re-creates exactly the split that produced #314 and #318. ## Validation Rebased onto current `main` (the earlier branch conflicted on `pnpm-lock.yaml` after `pdfjs-dist` moved to 6.2.108). The regenerated lockfile diff touches React entries only, and both integrity hashes match the npm registry. | Check | Result | |---|---| | `pnpm install --frozen-lockfile` | clean | | `pnpm -r typecheck` | pass | | `pnpm -r build` | pass | | `pnpm -r lint` | pass | | `apps/ui` unit tests | **1003 passed** (118 files) | | `apps/ui` Playwright smoke | **51 passed**, real Chromium | | Resolved versions | `react@19.2.8` + `react-dom@19.2.8` | Supersedes #314 and #318. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

* [Flight] Restore standard React version placeholder * [Flight Reply] Early bailout if backing entry for Blob deserialization is not a Blob (react#36055) Co-authored-by: Hendrik Liebau <mail@hendrik-liebau.de> (cherry picked from commit 12ba7d8) * [Flight] Avoid consuming cyclic models multiple times Co-authored-by: "Sebastian \"Sebbie\" Silbermann" <sebastian.silbermann@vercel.com> (cherry picked from commit 672b242) * [FlightReply] Type hardening and performance improvements Co-authored-by: Hendrik Liebau <mail@hendrik-liebau.de> (cherry picked from commit 795203e) * [FlightReply] Don't drop FormData entries in `decodeReplyFromBusboy` (react#36468) Fixes a regression from react#36425 where referenced `FormData` entries can be dropped by `decodeReplyFromBusboy` when files are interleaved with text fields in the payload. `decodeReplyFromBusboy` queues text fields that arrive while a file is being streamed and flushes them after the last file's `'end'`, working around busboy emitting `'end'` deferred relative to subsequent `'field'` events. With multiple files interleaved with text, this loses the relative order of the affected text entries. The reorder was a long-standing but invisible issue — entries came back in the wrong order but were all present — until react#36425 tightened how referenced FormData entries are collected from the backing store to rely on them being contiguous. With that assumption violated, referenced FormDatas can now come back with some entries dropped. The pattern is most easily surfaced through `useActionState` actions that return the submitted `FormData` as part of their state. This replaces the tail-flush with a linked list of pending files. Text fields that arrive while a file is in flight are queued on the tail file's `queuedFields`; fields that arrive when the list is empty resolve immediately. `flush()` walks from the head, resolving each completed file followed by its queued fields, and stops at the first file that hasn't ended yet. The backing FormData now matches the payload's order, restoring the contiguity assumption (and fixing the long-standing reorder as a side effect). The same change is applied to all five copies in `react-server-dom-{webpack,turbopack,parcel,esm,unbundled}`. Two new tests cover the multi-file interleave. fixes vercel/next.js#93822 (cherry picked from commit b91823e) * [FlightReply] Performance improvements when decoding (react#37087) This fixes security vulnerabilities in Server Functions. (cherry picked from commit 1dd4ecb) * [Flight Reply] Align Rspack decoders with upstream changes Mirror the selected Reply changes into the Rspack-owned browser, edge, and Node adapters after the dependency-closed upstream backports. Forward caller-provided array size limits, preserve multipart field/file order, and settle failed async iterators without recursive error re-entry. Add public behavior coverage across every Rspack decoder, action-selection path, cyclic collection type, iterator settlement, and Busboy ordering direction. This is a tactical source-parity change for the existing proposal branch; it does not make that branch current with React main. --------- Co-authored-by: Sebastian "Sebbie" Silbermann <sebastian.silbermann@vercel.com> Co-authored-by: Hendrik Liebau <mail@hendrik-liebau.de>

69fk4smh5f-netizen

Possible fix

tcka4enckoalexei2014-commits

1

This MR contains the following updates: | Package | Type | Update | Change | OpenSSF | |---|---|---|---|---| | [@ag-ui/client](https://github.com/ag-ui-protocol/ag-ui) | dependencies | patch | [`^0.0.57` → `^0.0.59`](https://renovatebot.com/diffs/npm/@ag-ui%2fclient/0.0.57/0.0.59) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/ag-ui-protocol/ag-ui/badge)](https://securityscorecards.dev/viewer/?uri=github.com/ag-ui-protocol/ag-ui) | | [@ag-ui/core](https://github.com/ag-ui-protocol/ag-ui) | dependencies | patch | [`^0.0.57` → `^0.0.59`](https://renovatebot.com/diffs/npm/@ag-ui%2fcore/0.0.57/0.0.59) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/ag-ui-protocol/ag-ui/badge)](https://securityscorecards.dev/viewer/?uri=github.com/ag-ui-protocol/ag-ui) | | [@eslint/js](https://eslint.org) ([source](https://github.com/eslint/eslint/tree/HEAD/packages/js)) | devDependencies | patch | [`9.39.4` → `9.39.5`](https://renovatebot.com/diffs/npm/@eslint%2fjs/9.39.4/9.39.5) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/eslint/eslint/badge)](https://securityscorecards.dev/viewer/?uri=github.com/eslint/eslint) | | [@testing-library/react](https://github.com/testing-library/react-testing-library) | devDependencies | patch | [`16.3.2` → `16.3.3`](https://renovatebot.com/diffs/npm/@testing-library%2freact/16.3.2/16.3.3) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/testing-library/react-testing-library/badge)](https://securityscorecards.dev/viewer/?uri=github.com/testing-library/react-testing-library) | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) | devDependencies | patch | [`25.9.5` → `25.9.6`](https://renovatebot.com/diffs/npm/@types%2fnode/25.9.5/25.9.6) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/DefinitelyTyped/DefinitelyTyped/badge)](https://securityscorecards.dev/viewer/?uri=github.com/DefinitelyTyped/DefinitelyTyped) | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/react) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react)) | devDependencies | patch | [`19.2.14` → `19.2.18`](https://renovatebot.com/diffs/npm/@types%2freact/19.2.14/19.2.18) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/DefinitelyTyped/DefinitelyTyped/badge)](https://securityscorecards.dev/viewer/?uri=github.com/DefinitelyTyped/DefinitelyTyped) | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/react-dom) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom)) | devDependencies | patch | [`19.2.3` → `19.2.7`](https://renovatebot.com/diffs/npm/@types%2freact-dom/19.2.3/19.2.7) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/DefinitelyTyped/DefinitelyTyped/badge)](https://securityscorecards.dev/viewer/?uri=github.com/DefinitelyTyped/DefinitelyTyped) | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/main/packages/plugin-react#readme) ([source](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react)) | devDependencies | patch | [`6.0.1` → `6.0.5`](https://renovatebot.com/diffs/npm/@vitejs%2fplugin-react/6.0.1/6.0.5) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/vitejs/vite-plugin-react/badge)](https://securityscorecards.dev/viewer/?uri=github.com/vitejs/vite-plugin-react) | | [eslint](https://eslint.org) ([source](https://github.com/eslint/eslint)) | devDependencies | patch | [`9.39.4` → `9.39.5`](https://renovatebot.com/diffs/npm/eslint/9.39.4/9.39.5) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/eslint/eslint/badge)](https://securityscorecards.dev/viewer/?uri=github.com/eslint/eslint) | | [eslint-import-resolver-typescript](https://github.com/import-js/eslint-import-resolver-typescript) | devDependencies | patch | [`4.4.4` → `4.4.5`](https://renovatebot.com/diffs/npm/eslint-import-resolver-typescript/4.4.4/4.4.5) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/import-js/eslint-import-resolver-typescript/badge)](https://securityscorecards.dev/viewer/?uri=github.com/import-js/eslint-import-resolver-typescript) | | [eslint-plugin-prettier](https://github.com/prettier/eslint-plugin-prettier) | devDependencies | patch | [`5.5.5` → `5.5.6`](https://renovatebot.com/diffs/npm/eslint-plugin-prettier/5.5.5/5.5.6) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/prettier/eslint-plugin-prettier/badge)](https://securityscorecards.dev/viewer/?uri=github.com/prettier/eslint-plugin-prettier) | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | devDependencies | patch | [`0.5.2` → `0.5.7`](https://renovatebot.com/diffs/npm/eslint-plugin-react-refresh/0.5.2/0.5.7) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/ArnaudBarre/eslint-plugin-react-refresh/badge)](https://securityscorecards.dev/viewer/?uri=github.com/ArnaudBarre/eslint-plugin-react-refresh) | | [i18next-http-backend](https://github.com/i18next/i18next-http-backend) | dependencies | patch | [`3.0.5` → `3.0.6`](https://renovatebot.com/diffs/npm/i18next-http-backend/3.0.5/3.0.6) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/i18next/i18next-http-backend/badge)](https://securityscorecards.dev/viewer/?uri=github.com/i18next/i18next-http-backend) | | [license-report](https://github.com/bepo65/license-report) | devDependencies | patch | [`6.8.2` → `6.8.5`](https://renovatebot.com/diffs/npm/license-report/6.8.2/6.8.5) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/bepo65/license-report/badge)](https://securityscorecards.dev/viewer/?uri=github.com/bepo65/license-report) | | [react](https://react.dev/) ([source](https://github.com/react/react/tree/HEAD/packages/react)) | dependencies | patch | [`19.2.5` → `19.2.8`](https://renovatebot.com/diffs/npm/react/19.2.5/19.2.8) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/react/react/badge)](https://securityscorecards.dev/viewer/?uri=github.com/react/react) | | [react-dom](https://react.dev/) ([source](https://github.com/react/react/tree/HEAD/packages/react-dom)) | dependencies | patch | [`19.2.5` → `19.2.8`](https://renovatebot.com/diffs/npm/react-dom/19.2.5/19.2.8) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/react/react/badge)](https://securityscorecards.dev/viewer/?uri=github.com/react/react) | | [react-i18next](https://github.com/i18next/react-i18next) | dependencies | patch | [`17.0.4` → `17.0.14`](https://renovatebot.com/diffs/npm/react-i18next/17.0.4/17.0.14) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/i18next/react-i18next/badge)](https://securityscorecards.dev/viewer/?uri=github.com/i18next/react-i18next) | | [react-router-dom](https://github.com/remix-run/react-router) ([source](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom)) | dependencies | patch | [`7.18.2` → `7.18.3`](https://renovatebot.com/diffs/npm/react-router-dom/7.18.2/7.18.3) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/remix-run/react-router/badge)](https://securityscorecards.dev/viewer/?uri=github.com/remix-run/react-router) | | [uuid](https://github.com/uuidjs/uuid) | dependencies | patch | [`14.0.0` → `14.0.2`](https://renovatebot.com/diffs/npm/uuid/14.0.0/14.0.2) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/uuidjs/uuid/badge)](https://securityscorecards.dev/viewer/?uri=github.com/uuidjs/uuid) | | [vite](https://vite.dev) ([source](https://github.com/vitejs/vite/tree/HEAD/packages/vite)) | devDependencies | patch | [`8.2.1` → `8.2.2`](https://renovatebot.com/diffs/npm/vite/8.2.1/8.2.2) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/vitejs/vite/badge)](https://securityscorecards.dev/viewer/?uri=github.com/vitejs/vite) | | [vitest](https://vitest.dev) ([source](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)) | devDependencies | patch | [`4.1.4` → `4.1.11`](https://renovatebot.com/diffs/npm/vitest/4.1.4/4.1.11) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/vitest-dev/vitest/badge)](https://securityscorecards.dev/viewer/?uri=github.com/vitest-dev/vitest) | --- ### Release Notes <details> <summary>eslint/eslint (@eslint/js)</summary> ### [`v9.39.5`](https://github.com/eslint/eslint/releases/tag/v9.39.5) [Compare Source](https://github.com/eslint/eslint/compare/v9.39.4...v9.39.5) ##### Bug Fixes - [`253be16`](https://github.com/eslint/eslint/commit/253be16a79a4c78eec4e0eb461b574d60dbf6b11) fix: handle unavailable require cache (backport of [#20812](https://github.com/eslint/eslint/issues/20812) to v9.x) ([#21065](https://github.com/eslint/eslint/issues/21065)) (Eric) ##### Documentation - [`74930ed`](https://github.com/eslint/eslint/commit/74930edd1ce0d246819edc72705101ec271da50b) docs: switch build to Node.js 24 ([#20894](https://github.com/eslint/eslint/issues/20894)) (Milos Djermanovic) - [`eaec8bb`](https://github.com/eslint/eslint/commit/eaec8bb6b1ca4b36985ee0222c457d4730d47a20) docs: Add ESLint v9.x EOL notice ([#20828](https://github.com/eslint/eslint/issues/20828)) (Milos Djermanovic) ##### Chores - [`458205f`](https://github.com/eslint/eslint/commit/458205f7d7a4769f32bec006eecc45c6a71be16a) chore: update `@eslint/eslintrc` and `@eslint/js` for v9.39.5 ([#21077](https://github.com/eslint/eslint/issues/21077)) (Francesco Trotta) - [`202117b`](https://github.com/eslint/eslint/commit/202117be549534715d687f988e17f29e1dcd0622) chore: package.json update for [@eslint/js](https://github.com/eslint/js) release (Jenkins) - [`d9eb6ed`](https://github.com/eslint/eslint/commit/d9eb6edcc93c1319ff1d2bb9aeb6d7d47bd73a79) test: disable warning for `vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER` ([#21074](https://github.com/eslint/eslint/issues/21074)) (Francesco Trotta) - [`7b431a7`](https://github.com/eslint/eslint/commit/7b431a7b19c345b8db56040b1888a3b531c3e64c) chore: override `re2` dependency for `@metascraper/helpers` ([#21068](https://github.com/eslint/eslint/issues/21068)) (Milos Djermanovic) - [`daf7791`](https://github.com/eslint/eslint/commit/daf77911de33be163503c6568ccb159741f4b018) chore: pin fflate\@0.8.2 ([#20895](https://github.com/eslint/eslint/issues/20895)) (Milos Djermanovic) - [`daee8ba`](https://github.com/eslint/eslint/commit/daee8ba3082afbc94d3b69ddc129d4dc664716f2) ci: use pnpm in `eslint-flat-config-utils` type integration test ([#20829](https://github.com/eslint/eslint/issues/20829)) (Milos Djermanovic) - [`116d4be`](https://github.com/eslint/eslint/commit/116d4bec7c0ddaeaa75f92fb1271a4ab70d24ce3) ci: unpin Node.js 25.x in CI ([#20619](https://github.com/eslint/eslint/issues/20619)) (Copilot) </details> <details> <summary>testing-library/react-testing-library (@testing-library/react)</summary> ### [`v16.3.3`](https://github.com/testing-library/react-testing-library/releases/tag/v16.3.3) [Compare Source](https://github.com/testing-library/react-testing-library/compare/v16.3.2...v16.3.3) ##### Bug Fixes - Avoid act() re-entrant when dispatching events ([#1468](https://github.com/testing-library/react-testing-library/issues/1468)) ([20ce75f](https://github.com/testing-library/react-testing-library/commit/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800)) </details> <details> <summary>vitejs/vite-plugin-react (@vitejs/plugin-react)</summary> ### [`v6.0.5`](https://github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#605-2026-07-30) [Compare Source](https://github.com/vitejs/vite-plugin-react/compare/f4b549822ec239799d746c030abb0b9a7d8f0a04...68c0cb8796ce18bd049c3d05c5210eaf0617eac0) ##### Fixed the react compiler preset filter to be linear ([#1353](https://github.com/vitejs/vite-plugin-react/pull/1353)) The improved filter in v6.0.3 was non-linear and caused a performance regression ([#1349](https://github.com/vitejs/vite-plugin-react/issues/1349)). The filter was changed to be linear to avoid that. ### [`v6.0.4`](https://github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#604-2026-07-22) [Compare Source](https://github.com/vitejs/vite-plugin-react/compare/640fd358a0e82393acfce4e92e19a6ac6e1641a7...f4b549822ec239799d746c030abb0b9a7d8f0a04) ##### Fixed `$RefreshSig$ is not defined` error when running `vite dev` with `NODE_ENV=production` When running `vite dev` with `NODE_ENV=production`, the app errored with `$RefreshSig$ is not defined`. This error is now fixed. ### [`v6.0.3`](https://github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#603-2026-06-23) [Compare Source](https://github.com/vitejs/vite-plugin-react/compare/6535b55e956b425e6650ffc2cc98fd23cca1d231...640fd358a0e82393acfce4e92e19a6ac6e1641a7) ##### Improve the react compiler preset filter to reduce false-positives ([#1138](https://github.com/vitejs/vite-plugin-react/pull/1138)) Improved the filter in the react compiler babel preset to reduce the false-positives so that less modules are processed by the react compiler. ### [`v6.0.2`](https://github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#602-2026-05-14) [Compare Source](https://github.com/vitejs/vite-plugin-react/compare/1e94c06995c2afe2d1fee5aea2ef9720d35a7e02...6535b55e956b425e6650ffc2cc98fd23cca1d231) ##### Allow all options in reactCompilerPreset ([#1189](https://github.com/vitejs/vite-plugin-react/pull/1189)) This is a type only change. Only `compilationMode` and `target` options were available for `reactCompilerPreset`. </details> <details> <summary>import-js/eslint-import-resolver-typescript (eslint-import-resolver-typescript)</summary> ### [`v4.4.5`](https://github.com/import-js/eslint-import-resolver-typescript/blob/HEAD/CHANGELOG.md#445) [Compare Source](https://github.com/import-js/eslint-import-resolver-typescript/compare/v4.4.4...v4.4.5) ##### Patch Changes - [#473](https://github.com/import-js/eslint-import-resolver-typescript/pull/473) [`32c61ab`](https://github.com/import-js/eslint-import-resolver-typescript/commit/32c61abccf26bd2a2267f2e0e67d82e6f88d149a) Thanks [@leey0818](https://github.com/leey0818)! - fix: check tsconfig matching before using resolver </details> <details> <summary>prettier/eslint-plugin-prettier (eslint-plugin-prettier)</summary> ### [`v5.5.6`](https://github.com/prettier/eslint-plugin-prettier/blob/HEAD/CHANGELOG.md#556) [Compare Source](https://github.com/prettier/eslint-plugin-prettier/compare/v5.5.5...v5.5.6) ##### Patch Changes - [#791](https://github.com/prettier/eslint-plugin-prettier/pull/791) [`b5c96a3`](https://github.com/prettier/eslint-plugin-prettier/commit/b5c96a30d3e292a379d6e8ac030c29fd7acbc90b) Thanks [@JounQin](https://github.com/JounQin)! - chore: bump all (dev)Dependencies </details> <details> <summary>ArnaudBarre/eslint-plugin-react-refresh (eslint-plugin-react-refresh)</summary> ### [`v0.5.7`](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/HEAD/CHANGELOG.md#057) [Compare Source](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/compare/v0.5.6...v0.5.7) ##### Add `allowCompoundComponents` option ([#117](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/pull/117)) > Default: `false` (`true` in `vite` config) Don't warn when components are exported as an object gathering them. Every member of the object must be a component, and a member holding an anonymous function requires a component name as key. This should be enabled if the fast refresh implementation correctly handles this case. Vite supports it since `@vitejs/plugin-react` 4.7.0, `@vitejs/plugin-react-swc` 3.11.0. ```json { "react-refresh/only-export-components": [ "error", { "allowCompoundComponents": true } ] } ``` Enabling this option allows code such as the following: ```jsx const Root = () => <></>; const Label = () => <></>; export const Tag = { Root, Label }; ``` ### [`v0.5.6`](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/HEAD/CHANGELOG.md#056) [Compare Source](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/compare/v0.5.5...v0.5.6) - Support re-exporting namespace components (fixes [#116](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/issues/116)) ### [`v0.5.5`](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/HEAD/CHANGELOG.md#055) [Compare Source](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/compare/v0.5.4...v0.5.5) - Fix SCREAMING\_SNAKE\_CASE constant exported via `export { Name }` incorrectly treated as React component [#114](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/pull/114) (fixes [#113](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/issues/113)) - Add `contentType` and `size` to `allowExportNames` in Next config [#115](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/pull/115) ### [`v0.5.4`](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/HEAD/CHANGELOG.md#054) [Compare Source](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/compare/v0.5.3...v0.5.4) - Add `instant` to `allowExportNames` in Next config [#112](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/pull/112) ### [`v0.5.3`](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/HEAD/CHANGELOG.md#053) [Compare Source](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/compare/v0.5.2...v0.5.3) - Fix check for non component class exported via `export { }` [#110](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/pull/110) (fixes [#109](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/issues/109)) </details> <details> <summary>i18next/i18next-http-backend (i18next-http-backend)</summary> ### [`v3.0.6`](https://github.com/i18next/i18next-http-backend/blob/HEAD/CHANGELOG.md#306) [Compare Source](https://github.com/i18next/i18next-http-backend/compare/v3.0.5...v3.0.6) - fix: allow forward slashes in `ns` values so nested namespace names (mapping to URL layouts such as `/locales/en/a/b.json`) fetch correctly again. 3.0.5's security fix applied the same strict URL-segment check to both `lng` and `ns`, which was correct for `lng` (no BCP-47 shape contains `/`) but over-strict for `ns` — nested namespaces containing `/` were never officially supported, but the behaviour fell out of the implicit string-substitution semantics of `loadPath` and is common enough in the wild to be worth accommodating. `isSafeUrlSegment` is now split into `isSafeLangUrlSegment` (strict — still rejects `/`) and `isSafeNsUrlSegment` (loose — allows `/` but still rejects `..`, `\`, URL-structure characters, control chars, prototype keys, and oversized inputs). `isSafeUrlSegment` is kept as a backwards-compatible alias for the strict check. The 3.0.5 security fix remains in force for every concrete attack pattern from the original advisory. </details> <details> <summary>bepo65/license-report (license-report)</summary> ### [`v6.8.5`](https://github.com/bepo65/license-report/blob/HEAD/CHANGELOG.md#685-2026-05-28) [Compare Source](https://github.com/bepo65/license-report/compare/v6.8.2...v6.8.5) </details> <details> <summary>react/react (react)</summary> ### [`v19.2.8`](https://github.com/react/react/releases/tag/v19.2.8): 19.2.8 (July 21st, 2026) [Compare Source](https://github.com/react/react/compare/v19.2.7...v19.2.8) ##### React Server Components - Performance improvements when decoding ([#37087](https://github.com/facebook/react/pull/37087) by [@eps1lon](https://github.com/eps1lon)) ### [`v19.2.7`](https://github.com/react/react/blob/HEAD/CHANGELOG.md#1927-June-1-2026) [Compare Source](https://github.com/react/react/compare/v19.2.6...v19.2.7) ##### React Server Components - Fixed missing `FormData` entries in Server Actions which regressed in 19.2.6 ([@unstubbable](https://github.com/unstubbable) [#36566](https://github.com/facebook/react/pull/36566)) ### [`v19.2.6`](https://github.com/react/react/blob/HEAD/CHANGELOG.md#1926-May-6-2026) [Compare Source](https://github.com/react/react/compare/v19.2.5...v19.2.6) ##### React Server Components - Type hardening and performance improvements ([@eps1lon](https://github.com/eps1lon), [@unstubbable](https://github.com/unstubbable) [#36425](https://github.com/facebook/react/pull/36425)) </details> <details> <summary>i18next/react-i18next (react-i18next)</summary> ### [`v17.0.14`](https://github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#17014) [Compare Source](https://github.com/i18next/react-i18next/compare/v17.0.13...v17.0.14) - fix: the `i18n` object returned by `useTranslation` was only refreshed when `i18n.language` changed, so a `resolvedLanguage` (or `languages`) change of its own kept handing components the previous snapshot. That happens whenever the translations for the current language arrive after the switch — i18next resolves to the fallback until its store has them — and components reading `i18n.resolvedLanguage` (language switchers, for example) then stayed one switch behind. The cached wrapper is now keyed on all three language fields, which are exactly the ones the surrounding `useMemo` already depends on; wrapper identity still only changes when the language state does, so the caching from [#1885](https://github.com/i18next/react-i18next/issues/1885) is unaffected. Reported via [next-i18next#2348](https://github.com/i18next/next-i18next/issues/2348). ### [`v17.0.13`](https://github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#17013) [Compare Source](https://github.com/i18next/react-i18next/compare/v17.0.12...v17.0.13) - fix(types): the selector-form `keyPrefix` overload of `useTranslation()` is now available under `enableSelector: 'strict'`. `useTranslation` was gated on `true | 'optimize'` only, so under `'strict'` it resolved to the legacy signature and the selector overload disappeared entirely (`keyPrefix: ($) => $.ns.foo` failed with `Type '($: any) => any' is not assignable to type 'undefined'`). `Trans` already handled all three modes. Companion to the same fix for `getFixedT` in [i18next#2446](https://github.com/i18next/i18next/pull/2446). Thanks [@hovelopin](https://github.com/hovelopin) ([#1930](https://github.com/i18next/react-i18next/pull/1930)). ### [`v17.0.12`](https://github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#17012) [Compare Source](https://github.com/i18next/react-i18next/compare/v17.0.11...v17.0.12) - fix(IcuTrans): key-less `icu.macro` nodes (`<Trans>Welcome, {name}!</Trans>`, `<Select>`, `<Plural>` without `i18nKey`) rendered an empty string since 17.0.0. The macro now emits `<IcuTrans defaultTranslation="…">` without a key and `IcuTrans` passed `undefined` to `t()`, which returns `''`. Like `Trans`, `IcuTrans` now uses `defaultTranslation` as the key when `i18nKey` is not provided. ### [`v17.0.11`](https://github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#17011) [Compare Source](https://github.com/i18next/react-i18next/compare/v17.0.10...v17.0.11) - chore: `html-parse-stringify` updated to `^4.0.1`. The parser powering `<Trans>` is now actively maintained under the i18next org ([i18next/html-parse-stringify](https://github.com/i18next/html-parse-stringify)) after years without upstream releases. 4.x brings modern dual ESM/CJS packaging with an `exports` map, zero runtime dependencies, reworked TypeScript types and a long list of parser fixes (literal `<` in text, multiline/CRLF attribute values, comments containing `>`, doctype handling, quote-aware bracket handling). - refactor(Trans): the internal `escapeLiteralLessThan` scanner (\~80 lines) is replaced by the parser's new `allowedTags` option with identical semantics: only numbered tags, kept basic HTML tags and known component names are parsed as markup, any other tag-shaped sequence in the translation stays literal text. Rendered output is unchanged (all 493 tests pass, including the [#1880](https://github.com/i18next/react-i18next/issues/1880) and [#1893](https://github.com/i18next/react-i18next/issues/1893) escaping cases). ### [`v17.0.10`](https://github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#17010) [Compare Source](https://github.com/i18next/react-i18next/compare/v17.0.9...v17.0.10) - fix(warnings): the `useTranslation` and `Trans` "You will need to pass in an i18next instance" warnings now match the `useSSR` wording, mentioning the props/context alternatives and the most common unexplained cause at scale: duplicate react-i18next copies in monorepo setups. The `Trans` variant also referenced the internal `i18nextReactModule` name; it now points to the public `initReactI18next` API. - feat(warnings): development-only warning (`SUSPENDED_WHILE_LOADING`, logged once) right before `useTranslation` suspends while translations are loading. With the default `useSuspense: true` and no `<Suspense>` boundary this previously surfaced as a blank screen or a cryptic React error; the warning now names both fixes (add a `<Suspense>` boundary or set `react.useSuspense: false`). No-op in production builds; the `process.env.NODE_ENV` check is wrapped so runtimes without a `process` global (raw ESM in the browser, some edge runtimes) stay silent instead of throwing. - ci: weekly workflow typechecking the test suite against `@types/react@next` / `@types/react-dom@next`, so the next React major's type changes (like the React 18 `TFunctionResult`/children wave) surface before user reports. ### [`v17.0.9`](https://github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#1709) [Compare Source](https://github.com/i18next/react-i18next/compare/v17.0.8...v17.0.9) - fix: allow TypeScript 7 in the optional `typescript` peer dependency range (`^5 || ^6 || ^7`). With `typescript@7.0.2` in a project, `npm install` failed with an `ERESOLVE` peer conflict. Fixes [#1927](https://github.com/i18next/react-i18next/issues/1927), thanks [@andikapradanaarif](https://github.com/andikapradanaarif). - fix(types): `<Trans t={t} ns="ns" …>` with a `t` from `useTranslation(['ns'])` now typechecks under TypeScript 7. TS7 intersects the `Ns` inference candidates coming from the `t` prop (`readonly ['ns']`) and the `ns` prop (`'ns'`) into an unsatisfiable `'ns' & readonly ['ns']`, where TS6 resolved them. The `ns` prop on `TransProps`, `TransSelectorProps` and `IcuTransWithoutContextProps` now also accepts a single namespace out of an array-typed `Ns` (`Ns | (Ns extends readonly (infer S extends string)[] ? S : never)`) — which matches runtime behavior and is unchanged under TS5/TS6. ### [`v17.0.8`](https://github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#1708) [Compare Source](https://github.com/i18next/react-i18next/compare/v17.0.7...v17.0.8) - fix(types): `<Trans i18nKey={$ => ...}>` now typechecks under `enableSelector: 'strict'`. The `Trans` component's conditional type was gated on `_EnableSelector extends true | 'optimize'`, excluding `'strict'` and falling back to the legacy string-key signature. Runtime was already correct (it calls `keyFromSelector(i18nKey)` whenever `typeof i18nKey === 'function'`); this is a type-only fix that widens the conditional to include `'strict'`. Thanks [@Faithfinder](https://github.com/Faithfinder) ([#1921](https://github.com/i18next/react-i18next/pull/1921)) ### [`v17.0.7`](https://github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#1707) [Compare Source](https://github.com/i18next/react-i18next/compare/v17.0.6...v17.0.7) - feat: `useTranslation([nsA, nsB, ...])` now passes its full namespace list to `getFixedT` via the new `scopeNs` opt (requires `i18next` ≥ v26.0.10). This makes selector calls with a secondary-namespace prefix resolve correctly under default `nsMode`: `t($ => $.nsB.foo)` previously missed silently because the bound `ns` was the primary string only and i18next's selector rewrite needed an array. Resolution semantics are unchanged — plain `t('key')` lookups still stay isolated to the primary namespace by default; use `nsMode: 'fallback'` to opt into multi-ns fallback resolution as before. Fixes [i18next#2429](https://github.com/i18next/i18next/issues/2429) for `useTranslation`-based callers. ### [`v17.0.6`](https://github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#1706) [Compare Source](https://github.com/i18next/react-i18next/compare/v17.0.5...v17.0.6) - fix: restore the v17 `nodesToString` output format consumed by `i18next-cli`'s extractor while still rendering [1919](https://github.com/i18next/react-i18next/issues/1919) correctly - 17.0.5 fixed [1919](https://github.com/i18next/react-i18next/issues/1919) by changing what `nodesToString` produced, which inadvertently changed the extracted translation strings for keep-tags wrapping non-keep React elements - The fix now lives in the renderer: indexed `<N>` placeholders nested inside a keep-tag are scoped to that tag's own original React children (matching kept tags by name and positional occurrence at each level), so the translation string format produced by `nodesToString` is unchanged ### [`v17.0.5`](https://github.com/i18next/react-i18next/blob/HEAD/CHANGELOG.md#1705) [Compare Source](https://github.com/i18next/react-i18next/compare/v17.0.4...v17.0.5) - fix: `<Trans />` no longer breaks child rendering when a kept HTML node (`transKeepBasicHtmlNodesFor`) wraps a non-keep React element [1919](https://github.com/i18next/react-i18next/issues/1919) — superseded by 17.0.6, which keeps the same runtime fix without changing the `nodesToString` output </details> <details> <summary>remix-run/react-router (react-router-dom)</summary> ### [`v7.18.3`](https://github.com/remix-run/react-router/compare/react-router-dom@7.18.2...react-router-dom@7.18.3) [Compare Source](https://github.com/remix-run/react-router/compare/react-router-dom@7.18.2...react-router-dom@7.18.3) </details> <details> <summary>uuidjs/uuid (uuid)</summary> ### [`v14.0.2`](https://github.com/uuidjs/uuid/blob/HEAD/CHANGELOG.md#1402-2026-08-18) [Compare Source](https://github.com/uuidjs/uuid/compare/v14.0.1...v14.0.2) ##### Bug Fixes - **v1:** carry nsecs overflow into the timestamp's high bits ([#972](https://github.com/uuidjs/uuid/issues/972)) ([6adcc1d](https://github.com/uuidjs/uuid/commit/6adcc1d81bfaeb653c49d9b7ca7b0579244ae60c)) - **v1:** set the multicast bit on v1Bytes's own randomly-generated node ([#973](https://github.com/uuidjs/uuid/issues/973)) ([b1da338](https://github.com/uuidjs/uuid/commit/b1da338815af4d919295eacb33aae340e372232a)) - **v7:** align default seq formula in v7Bytes with updateV7State ([#965](https://github.com/uuidjs/uuid/issues/965)) ([a67db57](https://github.com/uuidjs/uuid/commit/a67db57f7ae169e97c2573fd9d852b8364f89bf8)) ### [`v14.0.1`](https://github.com/uuidjs/uuid/blob/HEAD/CHANGELOG.md#1401-2026-06-20) [Compare Source](https://github.com/uuidjs/uuid/compare/v14.0.0...v14.0.1) ##### Bug Fixes - add types condition to node export for moduleResolution bundler ([#961](https://github.com/uuidjs/uuid/issues/961)) ([27ffae5](https://github.com/uuidjs/uuid/commit/27ffae5e867823b8c7db255975d65358fbdb1a7e)) </details> <details> <summary>vitejs/vite (vite)</summary> ### [`v8.2.2`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#830-2026-09-10) [Compare Source](https://github.com/vitejs/vite/compare/v8.2.1...v8.2.2) ##### Features - **build:** avoid settling seen preload dependencies for performance ([#23446](https://github.com/vitejs/vite/issues/23446)) ([e6f6b3e](https://github.com/vitejs/vite/commit/e6f6b3e3119256daa837b2dc399058c8aa45b470)) - **devtools:** enable dev server integration ([#23333](https://github.com/vitejs/vite/issues/23333)) ([68aeb8a](https://github.com/vitejs/vite/commit/68aeb8a3b5a5a2ccd505288999bae1a5e6942ee1)) - accept Rolldown watch options in `server.watch` ([#23133](https://github.com/vitejs/vite/issues/23133)) ([1b5cfe3](https://github.com/vitejs/vite/commit/1b5cfe3d3777d4ceb7f35fcee9d3c4279316a084)) - add closeServer and closePreviewServer hooks ([#23110](https://github.com/vitejs/vite/issues/23110)) ([e17d2d5](https://github.com/vitejs/vite/commit/e17d2d565b0288f169c7995adb2b192f917548e7)) - add top-level `tsconfig` option ([#23310](https://github.com/vitejs/vite/issues/23310)) ([93164c3](https://github.com/vitejs/vite/commit/93164c3530a7b4fc7bbedfb986d6afa9546cdef3)) - add warning for unsupported hooks in plugin returned from `applyToEnvironment` hook ([#23191](https://github.com/vitejs/vite/issues/23191)) ([fdef04f](https://github.com/vitejs/vite/commit/fdef04f112aadfea40ad3c448d96a49a04c168bd)) - **cli:** support naming the CPU profile via --profile \[name] ([#23042](https://github.com/vitejs/vite/issues/23042)) ([a500dee](https://github.com/vitejs/vite/commit/a500deeb6f52d93ca501a0fc612a5392b939f2f5)) - **config:** warn on named imports from JSON modules ([#23378](https://github.com/vitejs/vite/issues/23378)) ([472385e](https://github.com/vitejs/vite/commit/472385e6ec4b21e3167c7abf9769883d1c9675f8)) - **css:** minify style tag ([#23183](https://github.com/vitejs/vite/issues/23183)) ([8156684](https://github.com/vitejs/vite/commit/8156684572bdcf73e9d8568ed67971f0467fab60)) - searched params attached to workers are now preserved ([#22280](https://github.com/vitejs/vite/issues/22280)) ([517b97f](https://github.com/vitejs/vite/commit/517b97f57ab9473e7417da856eb641d76870a56e)) - support subpath imports in dynamic import statements ([#23185](https://github.com/vitejs/vite/issues/23185)) ([b78e2f1](https://github.com/vitejs/vite/commit/b78e2f1bc1cba404c4bd9faf518d26ec85e89fc7)) - use `import.meta.ROLLDOWN_FILE_URL_*` for assets in JS ([#22888](https://github.com/vitejs/vite/issues/22888)) ([4366ac4](https://github.com/vitejs/vite/commit/4366ac468343252df6d5706361a6348afa66f9cc)) - use `import.meta.ROLLDOWN_FILE_URL_*` for other plugins ([#22894](https://github.com/vitejs/vite/issues/22894)) ([e38f29e](https://github.com/vitejs/vite/commit/e38f29ee48bea5ea3178faec5b78708e86f38afb)) - **worker:** remove worker chunk if it's detected that it's not referenced ([#22473](https://github.com/vitejs/vite/issues/22473)) ([924997a](https://github.com/vitejs/vite/commit/924997a4bdda9115faee9bdb622fcec4fc8357f0)) ##### Bug Fixes - handle CRLF line endings in code frame positions ([#23219](https://github.com/vitejs/vite/issues/23219)) ([9913672](https://github.com/vitejs/vite/commit/9913672bee9c34a2df7fff4c2538783cd4f43b4e)) - only treat whole `node_modules` path segments as dependencies (fix [#17467](https://github.com/vitejs/vite/issues/17467)) ([#23437](https://github.com/vitejs/vite/issues/23437)) ([ef0dc17](https://github.com/vitejs/vite/commit/ef0dc17ada53d1169ae5a89cb8f6482831466755)) - **build:** keep hash placeholders as-is in `resolveFileUrl` hook ([#23422](https://github.com/vitejs/vite/issues/23422)) ([e8d6a4d](https://github.com/vitejs/vite/commit/e8d6a4d3399c739772080d70c7f3c4d548a637c9)) - **bundled-dev:** mark payload delivered on client report ([#23373](https://github.com/vitejs/vite/issues/23373)) ([a6d43bc](https://github.com/vitejs/vite/commit/a6d43bc9e3464faa4d49f090e75e1ab334ffb7b0)) - **deps:** update all non-major dependencies ([#23445](https://github.com/vitejs/vite/issues/23445)) ([fc7c104](https://github.com/vitejs/vite/commit/fc7c104e74d35a97fa313d5dd6f1b5e7d5b26159)) - **html:** don't inline preload link targets (fix [#13355](https://github.com/vitejs/vite/issues/13355)) ([#23387](https://github.com/vitejs/vite/issues/23387)) ([12e709c](https://github.com/vitejs/vite/commit/12e709ca4df1059747db1cb7c5d1cd71aba79a24)) - resolve the actual package root in findNearestMainPackageData for nested package.json ([#23356](https://github.com/vitejs/vite/issues/23356)) ([8492422](https://github.com/vitejs/vite/commit/8492422b8f110625a90c702f42f30784e8cf19dc)) - shortcuts extend error ([#23447](https://github.com/vitejs/vite/issues/23447)) ([4ec58d1](https://github.com/vitejs/vite/commit/4ec58d159df4a1b4799356a1fda62db88ed14752)) - **config:** close bundles when generation fails ([#23256](https://github.com/vitejs/vite/issues/23256)) ([6bacc95](https://github.com/vitejs/vite/commit/6bacc956df5a76cc5653b9de4493453b953439fd)) - **css:** keep newline-separated srcset candidates intact ([#23265](https://github.com/vitejs/vite/issues/23265)) ([4f9d2f4](https://github.com/vitejs/vite/commit/4f9d2f4dadc83191200de7d2154c957a711e8c3d)) - **deps:** update all non-major dependencies ([#23337](https://github.com/vitejs/vite/issues/23337)) ([d550815](https://github.com/vitejs/vite/commit/d55081581ddd4d55667fef38e85d02ab7f879f15)) - **deps:** update all non-major dependencies ([#23404](https://github.com/vitejs/vite/issues/23404)) ([238ad81](https://github.com/vitejs/vite/commit/238ad811c7fb9e4730cbd317d0657867ed3447b3)) - **deps:** update rolldown-related dependencies ([#23338](https://github.com/vitejs/vite/issues/23338)) ([76e8082](https://github.com/vitejs/vite/commit/76e8082c56a2872dc8017c5672bc36cba8dcf75d)) - **deps:** update rolldown-related dependencies ([#23405](https://github.com/vitejs/vite/issues/23405)) ([b882566](https://github.com/vitejs/vite/commit/b88256607e3a051b7bcb0b338b3c4665926b55a8)) - **dev:** run closeBundle after buildEnd failure ([#23165](https://github.com/vitejs/vite/issues/23165)) ([8cb872e](https://github.com/vitejs/vite/commit/8cb872e7fb65b03f6068923c6aa7fcf3e71baf21)) - **hmr:** handle `import.meta.hot.invalidate` in virtual module ([#23171](https://github.com/vitejs/vite/issues/23171)) ([6162968](https://github.com/vitejs/vite/commit/616296895bd135386d35069a479a5f188c7de298)) - **utils:** handle dot in srcset density descriptor ([#23346](https://github.com/vitejs/vite/issues/23346)) ([b50e1b4](https://github.com/vitejs/vite/commit/b50e1b4a3d66128a4076e19769b2e29657985516)) - **utils:** match timestamp query parameter with proper delimiters ([#23364](https://github.com/vitejs/vite/issues/23364)) ([41f3c6f](https://github.com/vitejs/vite/commit/41f3c6fff88ade015669cac5c42db946e0b6f5c9)) ##### Performance Improvements - **proxy:** pre-compile context matchers at server creation ([#23263](https://github.com/vitejs/vite/issues/23263)) ([8abf700](https://github.com/vitejs/vite/commit/8abf700eeb2411d8402d08f8e2696effafdbe774)) ##### Miscellaneous Chores - introducing `@e18e/eslint-plugin` ([#23357](https://github.com/vitejs/vite/issues/23357)) ([f794133](https://github.com/vitejs/vite/commit/f79413353995a2344879014410a9128b1b9f8e9a)) - remove unnecessary comment ([#23448](https://github.com/vitejs/vite/issues/23448)) ([b919a1a](https://github.com/vitejs/vite/commit/b919a1a8b5a7c694667f993d677973f42d349458)) - delete unused `PluginContainerOptions` ([#23382](https://github.com/vitejs/vite/issues/23382)) ([ee64401](https://github.com/vitejs/vite/commit/ee644014aab61e546742b862a7d7b0d6c7d67a7b)) - use oxfmt `sortImports` ([#23319](https://github.com/vitejs/vite/issues/23319)) ([97ad042](https://github.com/vitejs/vite/commit/97ad042170f4c71b518239723b733dd98e8e3e76)) ##### Code Refactoring - delete unused `esbuildPlugin` ([#23381](https://github.com/vitejs/vite/issues/23381)) ([f40efef](https://github.com/vitejs/vite/commit/f40efefbb3630cdb7235286bc2b51673d9fbfc27)) - exclude postfix from `__VITE_ASSET__` ([#22886](https://github.com/vitejs/vite/issues/22886)) ([a6c08e1](https://github.com/vitejs/vite/commit/a6c08e10a624bd89b78683ff1b0e8cfa1d89aa45)) - remove HmrUrl concept ([#23172](https://github.com/vitejs/vite/issues/23172)) ([67a6807](https://github.com/vitejs/vite/commit/67a680767317f8e2cb28b6b0500192f993a567cf)) - use `urlId` of `import.meta.ROLLDOWN_FILE_URL` in wasm plugin ([#22962](https://github.com/vitejs/vite/issues/22962)) ([92bd2a7](https://github.com/vitejs/vite/commit/92bd2a7f325ed102349cdc6c1ad4b5cd25e1d72f)) ##### Tests - add `renderBuiltUrl` change changes hash ([#23118](https://github.com/vitejs/vite/issues/23118)) ([0291408](https://github.com/vitejs/vite/commit/0291408b8443129ce6f6d1d440be8facabe9683b)) ##### Beta Changelogs ##### [8.3.0-beta.1](https://github.com/vitejs/vite/compare/v8.3.0-beta.0...v8.3.0-beta.1) (2026-09-07) See [8.3.0-beta.1 changelog](https://github.com/vitejs/vite/blob/v8.3.0-beta.1/packages/vite/CHANGELOG.md) ##### [8.3.0-beta.0](https://github.com/vitejs/vite/compare/v8.2.2...v8.3.0-beta.0) (2026-09-02) See [8.3.0-beta.0 changelog](https://github.com/vitejs/vite/blob/v8.3.0-beta.0/packages/vite/CHANGELOG.md) </details> <details> <summary>vitest-dev/vitest (vitest)</summary> ### [`v4.1.11`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.11) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.10...v4.1.11) ##### 🐞 Bug Fixes - Revive global concurrency limit for test lifecycle \[backport to v4] - by [@sheremet-va](https://github.com/sheremet-va) and [@hi-ogawa](https://github.com/hi-ogawa) in [#10992](https://github.com/vitest-dev/vitest/issues/10992) [<samp>(5146d)</samp>](https://github.com/vitest-dev/vitest/commit/5146df80b) - **browser**: - Encode iframeId in tester iframe URL \[backport to v4] - by [@sheremet-va](https://github.com/sheremet-va), **Pduhard** and **Claude Opus 4.8** in [#10955](https://github.com/vitest-dev/vitest/issues/10955) [<samp>(10b2c)</samp>](https://github.com/vitest-dev/vitest/commit/10b2cd201) - Trigger playwright/chromium gc on lower disk availability \[backport to v4] - by [@hi-ogawa](https://github.com/hi-ogawa), **Hiroshi Ogawa** and **OpenCode** in [#10951](https://github.com/vitest-dev/vitest/issues/10951) [<samp>(9851d)</samp>](https://github.com/vitest-dev/vitest/commit/9851dbc41) - **mocker**: - Restrict redirect mocks to the fs allowlist \[backport to v4] - by [@sheremet-va](https://github.com/sheremet-va) in [#10974](https://github.com/vitest-dev/vitest/issues/10974) [<samp>(fe5a1)</samp>](https://github.com/vitest-dev/vitest/commit/fe5a11d3c) ##### [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.10...v4.1.11) ### [`v4.1.10`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.10) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.9...v4.1.10) ##### 🐞 Bug Fixes - **browser**: Check fs access in builtin commands \[backport to v4] - by [@hi-ogawa](https://github.com/hi-ogawa), **Hiroshi Ogawa** and **OpenCode (claude-opus-4-8)** in [#10680](https://github.com/vitest-dev/vitest/issues/10680) [<samp>(5c18d)</samp>](https://github.com/vitest-dev/vitest/commit/5c18dd267) - **vm**: Fix external module resolve error with deps optimizer query for encoded URI \[backport to v4] - by [@SveLil](https://github.com/SveLil) and [@hi-ogawa](https://github.com/hi-ogawa) in [#10661](https://github.com/vitest-dev/vitest/issues/10661) [<samp>(bae52)</samp>](https://github.com/vitest-dev/vitest/commit/bae52b511) ##### [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.9...v4.1.10) ### [`v4.1.9`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.9) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9) ##### 🐞 Bug Fixes - Fix `importOriginal` with optimizer and query import \[backport to v4] - by **Hiroshi Ogawa**, **David Harris**, **Codex**and **Vladimir** in [#10546](https://github.com/vitest-dev/vitest/issues/10546) [<samp>(a5180)</samp>](https://github.com/vitest-dev/vitest/commit/a5180190c) - **browser**: - Wait for orchestrator readiness before resolving browser sessions \[backport to v4] - by **Vladimir** and **Séamus O'Connor** in [#10555](https://github.com/vitest-dev/vitest/issues/10555) [<samp>(7fb29)</samp>](https://github.com/vitest-dev/vitest/commit/7fb29651a) - Wait for iframe tester readiness before preparing \[backport to v4] - by **Vladimir** and **Séamus O'Connor** in [#10497](https://github.com/vitest-dev/vitest/issues/10497) and [#10556](https://github.com/vitest-dev/vitest/issues/10556) [<samp>(fbc62)</samp>](https://github.com/vitest-dev/vitest/commit/fbc626c40) - **mocker**: - Hoist vi.mock() for vite-plus/test imports \[backport to v4] - by **Hiroshi Ogawa**, **LongYinan**, **Claude Opus 4.8** and **Vladimir** in [#10548](https://github.com/vitest-dev/vitest/issues/10548) [<samp>(2c955)</samp>](https://github.com/vitest-dev/vitest/commit/2c9559c02) - **pool**: - Prevent test run hang on worker crash \[backport to v4] - by **Ari Perkkiö** and **Jattioui Ismail** in [#10543](https://github.com/vitest-dev/vitest/issues/10543) and [#10564](https://github.com/vitest-dev/vitest/issues/10564) [<samp>(934b0)</samp>](https://github.com/vitest-dev/vitest/commit/934b0f587) ##### [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9) ### [`v4.1.8`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.8) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.7...v4.1.8) ##### 🐞 Bug Fixes - **browser**: - Disable client `cdp` API when `allowWrite/allowExec: false` \[backport to v4] - by [@hi-ogawa](https://github.com/hi-ogawa) and **Codex** in [#10450](https://github.com/vitest-dev/vitest/issues/10450) [<samp>(e4067)</samp>](https://github.com/vitest-dev/vitest/commit/e4067b3b1) - Remove orphaned Playwright route when same module is mocked via multiple ids \[backport to v4] - by [@toxik](https://github.com/toxik) and [@Zelys-DFKH](https://github.com/Zelys-DFKH) in [#10474](https://github.com/vitest-dev/vitest/issues/10474) [<samp>(675b4)</samp>](https://github.com/vitest-dev/vitest/commit/675b4343f) ##### [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.7...v4.1.8) ### [`v4.1.7`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.7) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.6...v4.1.7) ##### 🐞 Bug Fixes - **runner**: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by [@hi-ogawa](https://github.com/hi-ogawa) in [#10384](https://github.com/vitest-dev/vitest/issues/10384) [<samp>(4f0f2)</samp>](https://github.com/vitest-dev/vitest/commit/4f0f2a1ee) ##### [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.6...v4.1.7) ### [`v4.1.6`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.6) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.5...v4.1.6) ##### 🐞 Bug Fixes - **browser**: Provide project reference in `ToMatchScreenshotResolvePath` - by [@macarie](https://github.com/macarie) and [@sheremet-va](https://github.com/sheremet-va) in [#10138](https://github.com/vitest-dev/vitest/issues/10138) [<samp>(31882)</samp>](https://github.com/vitest-dev/vitest/commit/31882607c) - Global `sequence.concurrent: true` with top-level `test(..., { concurrent: false })` + depreacte `sequential` test API and options - by [@hi-ogawa](https://github.com/hi-ogawa), **Codex** and [@sheremet-va](https://github.com/sheremet-va) in [#10196](https://github.com/vitest-dev/vitest/issues/10196) [<samp>(2847d)</samp>](https://github.com/vitest-dev/vitest/commit/2847dfa2a) - **browser**: Simplify orchestrator otel carrier - by [@hi-ogawa](https://github.com/hi-ogawa) in [#10285](https://github.com/vitest-dev/vitest/issues/10285) [<samp>(18af9)</samp>](https://github.com/vitest-dev/vitest/commit/18af98cee) ##### 🏎 Performance - Stringify diff objects only once - by [@sheremet-va](https://github.com/sheremet-va) in [#10276](https://github.com/vitest-dev/vitest/issues/10276) [<samp>(9f7b1)</samp>](https://github.com/vitest-dev/vitest/commit/9f7b1528c) ##### [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.5...v4.1.6) ### [`v4.1.5`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.5) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.4...v4.1.5) ##### 🚀 Experimental Features - **coverage**: Istanbul to support `instrumenter` option - by [@BartWaardenburg](https://github.com/BartWaardenburg) and [@AriPerkkio](https://github.com/AriPerkkio) in [#10119](https://github.com/vitest-dev/vitest/issues/10119) [<samp>(0e0ff)</samp>](https://github.com/vitest-dev/vitest/commit/0e0ff41c7) ##### 🐞 Bug Fixes - \--project negation excludes browser instances - by [@felamaslen](https://github.com/felamaslen) in [#10131](https://github.com/vitest-dev/vitest/issues/10131) [<samp>(9423d)</samp>](https://github.com/vitest-dev/vitest/commit/9423dc084) - Project color label on html reporter - by [@hi-ogawa](https://github.com/hi-ogawa) in [#10142](https://github.com/vitest-dev/vitest/issues/10142) [<samp>(596f7)</samp>](https://github.com/vitest-dev/vitest/commit/596f73986) - Fix `vi.defineHelper` called as object method - by [@hi-ogawa](https://github.com/hi-ogawa) in [#10163](https://github.com/vitest-dev/vitest/issues/10163) [<samp>(122c2)</samp>](https://github.com/vitest-dev/vitest/commit/122c25b5b) - Alias `agent` reporter to `minimal` - by [@sheremet-va](https://github.com/sheremet-va) in [#10157](https://github.com/vitest-dev/vitest/issues/10157) [<samp>(663b9)</samp>](https://github.com/vitest-dev/vitest/commit/663b99fe3) - Respect diff config options in soft assertions - by [@Copilot](https://github.com/Copilot), **sheremet-va** and [@sheremet-va](https://github.com/sheremet-va) in [#8696](https://github.com/vitest-dev/vitest/issues/8696) [<samp>(9787d)</samp>](https://github.com/vitest-dev/vitest/commit/9787dedad) - Respect diff config options in soft assertions " - by [@sheremet-va](https://github.com/sheremet-va) in [#8696](https://github.com/vitest-dev/vitest/issues/8696) [<samp>(7dc6d)</samp>](https://github.com/vitest-dev/vitest/commit/7dc6d54fd) - **ast-collect**: Recognize \_*vi\_import* prefix in static test discovery - by [@Yejneshwar](https://github.com/Yejneshwar) in [#10129](https://github.com/vitest-dev/vitest/issues/10129) [<samp>(32546)</samp>](https://github.com/vitest-dev/vitest/commit/325463ab2) - **coverage**: Descriptive error message when reports directory is removed during test run - by [@DaveT1991](https://github.com/DaveT1991) and [@AriPerkkio](https://github.com/AriPerkkio) in [#10117](https://github.com/vitest-dev/vitest/issues/10117) [<samp>(14133)</samp>](https://github.com/vitest-dev/vitest/commit/1413382e1) - **snapshot**: Increase default snapshot max output length - by [@hi-ogawa](https://github.com/hi-ogawa) and **Codex** in [#10150](https://github.com/vitest-dev/vitest/issues/10150) [<samp>(21e66)</samp>](https://github.com/vitest-dev/vitest/commit/21e66ff63) - **ui**: Fix jsx/tsx syntax highlight - by [@hi-ogawa](https://github.com/hi-ogawa) in [#10152](https://github.com/vitest-dev/vitest/issues/10152) [<samp>(f1b1f)</samp>](https://github.com/vitest-dev/vitest/commit/f1b1f6c7b) - **web-worker**: Support MessagePort objects referenced inside postMessage data - by [@whitphx](https://github.com/whitphx) and **Claude Opus 4.6 (1M context)** in [#9927](https://github.com/vitest-dev/vitest/issues/9927) and [#10124](https://github.com/vitest-dev/vitest/issues/10124) [<samp>(7ad7d)</samp>](https://github.com/vitest-dev/vitest/commit/7ad7d39af) - **api**: Make test-specification options writable - by [@sheremet-va](https://github.com/sheremet-va) in [#10154](https://github.com/vitest-dev/vitest/issues/10154) [<samp>(6abd5)</samp>](https://github.com/vitest-dev/vitest/commit/6abd557b7) ##### [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.4...v4.1.5) </details> --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  See merge request swiss-armed-forces/cyber-command/cea/loom!459 Co-authored-by: Loom MR Pipeline Trigger <group_103951964_bot_9504bb8dead6d4e406ad817a607f24be@noreply.gitlab.com> Co-authored-by: shrewd-laidback palace <shrewd-laidback-palace-736-c41-2c1-e464fc974@swiss-armed-forces-open-source.ch>

eps1lon added 2 commits July 6, 2026 16:04

[FlightReply] Performance improvements when decoding

4a79595

Version 19.2.8

97bf076

meta-cla Bot added the CLA Signed label Jul 21, 2026

eps1lon requested a review from gnoff July 21, 2026 15:19

github-actions Bot added the React Core Team Opened by a member of the React Core Team label Jul 21, 2026

gnoff approved these changes Jul 21, 2026

View reviewed changes

eps1lon merged commit 1dd4ecb into releases/19.2.x Jul 21, 2026
27 of 42 checks passed

This was referenced Jul 22, 2026

Update all of react 19.2.7 → 19.2.8 (patch) guibranco/crm-dashboard#263

Merged

Update all of react 19.2.7 → 19.2.8 (patch) guibranco/finorganizer-ui#13

Merged

This was referenced Jul 24, 2026

fix(deps): update react monorepo to v19.2.8 daisuke-tanabe/pokedex#288

Merged

fix(deps): update react monorepo to v19.2.8 thinceller/thinceller.net#1357

Merged

chore(deps): update dependency react-dom to v19.2.8 - autoclosed cbcoutinho/astrolabe#261

Closed

griffinwork40 mentioned this pull request Jul 26, 2026

chore(deps): bump react-dom from 19.2.7 to 19.2.8 in /website griffinwork40/agent-afk#706

Merged

github-actions Bot mentioned this pull request Jul 27, 2026

build(deps): bump react-dom from 19.2.7 to 19.2.8 samelliottdlt/website#99

Merged

mogplex Bot mentioned this pull request Aug 1, 2026

chore(deps): bump the react group with 2 updates webrenew/unicon#204

Closed

shoji9x9 mentioned this pull request Aug 3, 2026

chore(deps): Bump the patch group with 3 updates shoji9x9/portfolio#34

Merged

JakeSchumer mentioned this pull request Aug 3, 2026

build(deps): update React packages to 19.2.8 Macrify-LLC/raiopdf#325

Merged

eps1lon deleted the sebbie/july-vulns/19.2.x branch August 12, 2026 11:26

claude Bot mentioned this pull request Aug 13, 2026

fix(deps): update react monorepo cbcoutinho/astrolabe#268

Merged

1 task

brandhaug mentioned this pull request Aug 13, 2026

chore(deps): bump all-patch-updates dependencies brandhaug/b2b-saas-starter#15

Merged

sidorovanthon mentioned this pull request Aug 15, 2026

chore(deps): land the nine remaining Renovate bumps as one batch bbm-academy-org/bbm-portal#241

Merged

5 tasks

69fk4smh5f-netizen reviewed Aug 22, 2026

View reviewed changes

This was referenced Aug 22, 2026

chore(deps): bump react from 19.2.7 to 19.2.8 OpenDIKW/dikw-web#164

Open

chore(deps): bump react-dom and @types/react-dom OpenDIKW/dikw-web#176

Open

tcka4enckoalexei2014-commits reviewed Aug 29, 2026

View reviewed changes

github-actions Bot mentioned this pull request Sep 4, 2026

fix(deps): update react monorepo to v19.2.8 lacolaco/blog.lacolaco.net#1987

Merged

1 task

alexsiri7 mentioned this pull request Sep 7, 2026

chore(deps): bump react-dom and @types/react-dom alexsiri7/word-coach-annie#1099

Merged

Navigation Menu

[FlightReply] Performance improvements when decoding - #37087

[FlightReply] Performance improvements when decoding#37087
eps1lon merged 2 commits into
releases/19.2.xfrom
sebbie/july-vulns/19.2.x

eps1lon commented Jul 21, 2026

Uh oh!

Uh oh!

69fk4smh5f-netizen left a comment

Uh oh!

tcka4enckoalexei2014-commits left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

eps1lon commented Jul 21, 2026

Uh oh!

Uh oh!

69fk4smh5f-netizen left a comment

Choose a reason for hiding this comment

Uh oh!

tcka4enckoalexei2014-commits left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants